The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash in

A flaw in PHP, the software behind an estimated 70% of the web, has turned into the latest proof that AI is changing cyber defense as fast as attack. Researchers using AI tools found the bugs in August, and the package of vulnerabilities and exploit methods is now known as php2shell. OpenAI’s GPT-5.6 Sol appears to have helped find it, with Google’s Gemini 4 Argon also in the mix.

The public only learned about the issue this week, after the PHP Foundation said on Oct. 20 it would issue a critical patch within 24 hours. A coalition including OpenAI, Wiz, Calif and others had already been working privately on the fix and disclosed it the next day. But the clock was already working against them. Amazon Web Services says hackers began exploiting php2shell on Oct. 17, before the public announcement, and there were “millions” of attempts after disclosure.

That rush exposed the awkward truth of modern security: even a patched bug can still be a live threat while companies race to apply it. Some governments and private organizations took services offline rather than leave them exposed during the waiting period. That protected the systems, but it also cut off access for users. WordPress, the service most affected by the bug, says it has not seen issues.

For OpenAI, this is also a sales pitch. Its Daybreak program gives approved organizations access to its most advanced tools so they can find and fix weaknesses before attackers do. The company says the number of flaws found through the program rose from 858 to 1,885, and patches produced climbed from 263 to 661. Greg Brockman even pinned a lengthy post about the PHP exploit to the top of his X profile, which is not exactly subtle branding.

The bigger bet is obvious. OpenAI has hired a chief revenue officer with a cybersecurity background, is building a sales team for defensive software, and plans to debut a cybersecurity-focused model this fall along with a tool to help businesses deploy it across their infrastructure. Anthropic has its own cybersecurity effort, Project Glasswing. The market for AI defense is getting real because the threat is getting real, and because the internet now seems to need a guard dog that can also read code.